In order to check the current installed version of PowerShell use PSVersionTable.PSVersion. If PSVersion variable does not exists them it is Version 1.0, as it was available at that time.

Rozena belongs to a growing family of file less malware. Its executable is disguised with Microsoft Office Word Document's icon that lure its victim to open it. Upon execution, it creates a file in Windows Temporary folder with a filename Hi6kI7hcxZwUI.